Cybersecurity Considerations for Remote Work

NCUA Risk Alert: 20-Risk-01 Cybersecurity Considerations for Remote Work

April 2020

Common cybersecurity risks for remote workers include Malware attacks, Phishing and other social engineering attacks, and Advance Persistent Threat (APT) attacks.

NCUA issued Risk Alert 20-Risk-01 to remind credit unions of the need to ensure that employees working remotely adhere to sound cyber hygiene on their home networks, personal computing devices, and other internet-connected devices. Credit unions must exercise controls over remote work commensurate with the institution’s size and complexity and be prepared to respond to any incidents that may occur.

Preparing Employees to Prevent Security Incidents

Credit unions should be communicating with remote employees to verify that work is being done securely. To minimize the risk of a successful cyber attack on remote employees, credit union policies should address issues such as:

  • Ensuring that family members or others do not use employee’s designated work device and that employees keep devices physically secure;
  • Encrypting sensitive information, using strong encryption options for wireless systems, and implementing session time outs;
  • Ensuring employees are working with a user account and not an administrator or privileged account and establishing strong, unique passwords for all log-ins and devices on the employee’s home network;
  • Leveraging firewall capabilities available through internet service providers;
  • Updating software and removing unnecessary services and software;
  • Ensuring system and account logs are being collected and maintained

Responding to a Security Incident

Credit union policies for remote employees should address actions the employee should take if they suspect a cyber incident and what responses the credit union will take.

Cybersecurity Resources

Additional resources are available at:

NCUA Interim Final Rule: Part 725 Central Liquidity Facility

Prepared by NASCUS Legislative & Regulatory Affairs Department
April 2020

NCUA has published an Interim Final Rule (IFR) making changes to NCUA’s Central Liquidity Facility (CLF). The IFR makes implementing changes pursuant to temporary changes made to the CLF by § 4016 of  HR 748, the CARES Act. The CLF is governed by Title III of the Federal Credit Union Act (FCUA) and Part 725. Both federally and privately insured credit unions may access the CLF.

The CARES Act made 4 changes to Title III that all will sunset on December 31, 2020:

  • Increased the CLF maximum borrowing authority to 16 times stock and surplus
  • Permits corporate credit unions to borrow for their own needs
  • Provides greater flexibility and affordability to corporate credit unions to serve as agents by allowing smaller pools of stock subscription
  • Provides NCUA more flexibility in approving loans by eliminating the limitation on borrowing to expand portfolios

In addition, NCUA’s IFR also made the following 3 changes to the CLF:

  • Eliminated the 6-month waiting period for a new member to receive a loan
  • Expedited credit union’s ability to terminate its membership in the CLF
  • Eased collateral requirements for certain assets securing loans

The Interim Final Rule proposed rule may be read here. Comments are due to NCUA 60 days after publication in the Federal Register. As of April 24, 2020, the rule has not been published in the Federal Register.

Summary

NCUA is making changes to the CLF that will allow corporate credit unions to join the CLF directly in their own right for a temporary period  as well as changing the rules for subscriptions when a corporate credit union acts an agent for its natural person credit union members. The changes related to corporate credit unions will sunset on December 31, 2020. NCUA is also making changes to allow credit union joining the CLF to immediately seek an advance of funds. Currently, a credit union must be subscribed for 6 months before seeking an advance.

  1. Changes Related to Corporate Credit Unions

In accordance with the CARES Act, NCUA is amending the definition of “Liquidity needs” in § 725.2(i) to remove the words “primarily serving natural persons.” This change allows corporate credit unions to access the CLF directly for their own borrowing needs until December 31, 2020. In addition, § 725.17(b)(2) will be amended to make clear that a corporate may apply for a CLF advance for its own liquidity needs.

Should a corporate seek to borrow from the CLF for its own liquidity needs, § 725.4 is being amended to require the corporate subscribe to CLF stock in an amount equal to .5% the corporate’s paid-in and unimpaired capital and surplus.

In addition, NCUA will make cohering changes to Parts 725.18(a) and 725.19(b) to apply to agent loans the same creditworthiness and collateral requirements that currently apply to CLF advances to natural person credit union members.

Once the provision sunsets, a corporate agent may not request any additional CLF advances for its own liquidity needs and must continue to follow the terms of the borrowings outstanding.

NCUA is also changing the subscription requirement for corporate credit unions to act as agent for natural person credit unions. Currently, § 725.4(a)(2) requires the corporate credit union agent to subscribe to the capital stock of the CLF in an amount equal to .5%

of the paid-in and unimpaired capital and surplus of all its natural person credit union members (except those that subscribe to CLF stock directly or have designated another corporate as their agent). Under NCUA’s changes, the NCUA will designate the group of credit unions which are considered covered by the corporate credit union’s agency and that group will serve as the basis for calculating the subscription amount required for purchase. This implements the changes made by the CARES Act to § 1795c(b)(2) of the FCUA. This change also sunsets on December 31, 2020.

Upon the sunset of this modified agent provision, any corporate credit union that became an agent under this provision must, within one-year from the sunset date, either:

  • purchase CLF stock in accordance with the terms of whatever post sunset regulation is implemented; or
  • terminate its membership in the facility

NCUA specifically seeks comment on whether the one-year time frame is sufficient, or whether a longer or shorter timeframe is warranted.

  1. Regular Membership Requirements

NCUA is eliminating the current § 725.3 six-month waiting period on obtaining CLF advances for a credit union that becomes a regular member. Now a credit union that becomes a member of the CLF may immediately seek an advance from the facility.

Under the FCU Act and current § 725.6 a credit union member may terminate its membership in the after a specified notice period based upon the amount of subscription:

 

% of CLF Stock Held by Credit Union

 

 Notice Period
Less than 5% total CLF stock Membership terminates 6 months after giving written notice to NCUA
5% or more of total CLF stock Membership terminates 24 months after giving NCUA written notice

 

NCUA is enacting a temporary change to the waiting periods for terminating CLF membership.

 

The Board is amending the waiting periods for a credit union to terminate its membership in the CLF between publication of the rule in the Federal Register and January 1, 2022. The temporary termination rules will be as follows:

 

Between May 2020 and December 31, 2020

 Any credit union, regardless of its percentage of CLF stock ownership may terminate its membership on the sooner of 6 months written notice or on December 31, 2020
 

Between January 1, 2021 and December 31, 2021

 Any credit union “still a member” on December 31, 2020 may terminate its membership immediately upon notifying NCUA
 

After January 1, 2022

 CLF membership termination will revert to the pre-amendment 6 month and 24 month notice and waiting periods

 

NCUA is also changing the collateral requires for advances from the CLF. NCUA will publish a collateral table on its website. The collateral required will vary based upon the types of assets the member credit union has available to secure the advance. Depending on the types of assets held by a CLF member, this change by NCUA might ease the collateral requirements which in turn might result in a higher borrowing capacity for the credit union seeking an advance.

Currently, § 725.19(a) requires collateralization of 110% of all outstanding advances without regard to the nature of the assets being pledged.

NCUA Proposed Rule: Part 704  Corporate Credit Unions

Prepared by NASCUS Legislative & Regulatory Affairs Department
April 2020

 NCUA is proposing changes to Part 704, the Corporate Credit Union Rule. The rule applies to state-chartered corporate credit unions by reference in Part 741.206. This proposal represents the 4th revision to corporate credit union rules since the economic crisis of 2008.

NCUA’s proposal would:

  • Permit corporate credit unions to make de minimis investments in natural person credit union CUSOs without those CUSOs being regulated as corporate CUSOs
  • Expands the category of senior staff eligible to serve on a corporate’s board
  • Removes experience and independence requirements for the enterprise risk management officer
  • Establishes rules for corporate investment in subordinated debt of natural person credit unions
  • Reduces the time horizon of NII modelling from 2 years to 1 year
  • Create a new Appendix D to the listing all approved corporate CUSO services
  • Clarifies the prohibition against investments in collateralized debt obligations as applying to both loans and debt securities

The proposed rule may be read here. Comments are due to NCUA July 27, 2020.

** Note, the comment period was extended to July 27, 2020 in a subsequent filing.

 Summary

  • NCUA Proposes easing the limitations on corporate credit union CUSO investments

Part 704.11 governs corporate credit union CUSOs. A corporate credit union CUSO is defined as an entity that is 1) at least partly owned by a corporate credit; 2) primarily serves credit unions; 3) restricts its services to those related to the normal course of business of credit unions; and 4) is structured as a corporation, limited liability company, or limited partnership under state law.

There is no exception under § 704 for de minimis investments by a corporate credit union into another entity. If the corporate credit union invests, the entity is a corporate CUSO and must meet the other requirements of Part 704.11.

The proposed rule amends the definition of corporate CUSO to allow a corporate credit union to make a de minimis non-controlling investment in a natural credit union CUSO without the CUSO being deemed a corporate CUSO. NCUA cites several benefits to the credit union system from this rule change:

  • Natural person CUSOs have greater flexibility than corporate CUSOs which may better facilitate innovation, product, and service development
  • Corporate credit union participation in the natural person CUSO pool allows corporates to access innovative development while providing natural person credit unions a larger pool of investors and collaborators

 

  • NCUA will make conforming changes to § 704.2 Definitions and to References in § 704.5, § 704.6, and § 704.7

To recognize that corporate credit unions would be allowed to hold de minimis non-controlling investments in natural person credit union CUSOs, NCUA would expand and revise the CUSO definitions in § 704.2. The proposal defines a “Corporate CUSO” as a CUSO where:

  • a corporate owns 25% of the CUSOs stock or equity
  • the CUSO a consolidated CUSOSO
  • a corporate credit union has the power, directly or indirectly, to direct the CUSO’s management or policies
  • the aggregate corporate credit union ownership meets or exceeds 50% of the CUSO’s contributed equity, stock, or membership interests

NCUA would also add a definition for a “CUSO” to reflect that corporates might invest in a natural person credit union CUSO WITHOUT a controlling interest. Finally, the existing definition of “Consolidated Credit Union Service Organization” would be amended to include any CUSO whether a corporate CUSO or a natural person credit union CUSO.

Rule would replace the term corporate CUSO with CUSO to apply to both corporate and natural person credit union CUSOs for purposes of the credit risk management, investments, and lending provisions of the rule.

 

The proposal would create a new definition for “natural person credit union subordinated debt instrument” referring to any debt instrument issued by a natural person credit union pursuant to such rules for federally insured credit unions.

The proposal would change the defined term “collateralized debt obligation” to “collateralized loan or debt obligation,” to clarify that the prohibition applies to both loans and debt securities.

  • Part 704.11 would be Reorganized

The proposed changes to § 704.11 clarify that certain requirements apply to a corporate credit union’s investment in or lending to both a corporate CUSO and a natural person credit union CUSO while certain requirements apply only to either natural person CUSOs or corporate CUSOs.

Part 704.11(a) would be amended to make clear that the existing aggregate investment and loan limits apply to the aggregate of a corporate’s loans and investments to all CUSOs whether corporate or natural person.

Part 704.11(b) would require corporate credit unions comply with § 723.4 due diligence requirements

Part 704.11(c) would require corporate credit union investments in natural person credit union CUSOs comport to Part 712 as well. NCUA states that the corporate credit union’s investment in a FISCU’s CUSO would also be subject to § 712.

Part § 704.11(e) would designate any subsidiary of a corporate CUSO as a corporate CUSO and apply § 704 to all tiers of a corporate CUSO.

  • Part 704.19 Disclosure of Executive Compensation

Under the proposed rule, § 704.19 would require that the disclosure of certain employees’ compensation include BOTH compensation from a corporate CUSO and a natural person credit union CUSO. However while current § 704.11(g) requires a corporate CUSO to disclose compensation paid to any employees that are also employees of a corporate credit union lending to or investing in the CUSO, natural person credit union CUSOs will not be required under the Corporate Credit Union rule to disclose such information. Corporate credit unions would be responsible for getting this information from a natural person credit union CUSO.

  • Part 704.14 Corporate Credit Union Board Representation

Part 704.14 currently requires credit union representatives on the corporate’s board must hold the position of chief executive officer, chief financial officer, chief operating officer, or treasurer/manager at a member credit union. Under the proposal, NCUA would no longer expressly limit the corporate credit union board to the above stated positions. The proposed rule would require the credit union representative board members by any person in a senior staff position at a member credit union. The rule would list the above positions as examples and add two new positions to the list: chief information officer and chief risk officer.

  • Part 704.21 Enterprise Risk Management

Since 2011 § 704.21 has required corporate credit unions develop and follow an enterprise risk management policy, establish an enterprise risk management committee (ERMC) and include an independent risk management expert on that committee. The current rule included a prescriptive list of qualifications for the risk management expert as well as a requirement the expert be “independent” of the corporate credit union. NCUA no longer believes that it is necessary for prescriptive experience requirements and for the risk management expert to be independent of the corporate credit union. The proposed rule would require the enterprise risk management committee include a risk management expert who can report directly to the board of directors and whose experience is commensurate with the size and complexity of the corporate. In other words, the risk management expert may now be an insider. NCUA will evaluate the adequacy of a corporate credit union’s enterprise risk management practices through the supervisory process.

  • Natural Person Credit Union Subordinated Debt Instruments

Corporate credit unions may purchase subordinated debt instruments of natural person credit unions under a corporate credit union’s lending authority. The proposed rule does not explicitly state that a corporate credit union may purchase a natural person credit union subordinate debt instrument because NCUA believes corporate credit unions’ lending authority is currently sufficiently broad to include purchasing subordinated debt instruments.

Under the proposal, the revised definition of “Tier I Capital” would require corporate credit unions fully deduct the amount of the subordinated debt instrument from its tier 1 capital to ensure consistent treatment between investments in the capital of other corporate credit unions and natural person credit unions.

  • New Appendix D: Approved Corporate CUSO Activities

Current § 704.11 requires that a corporate CUSO agree to limit its services to brokerage services, investment advisory services, and other categories of services as preapproved by NCUA and published on NCUA’s Website. NCUA now proposes replacing the list on the agency’s website with a new Appendix D that would list all approved services and any conditional approvals. NCUA is not making any changes to the list, only republishing the list as part of the rule text.

 

  • Net Interest Income Modeling

 

Under current § 704.8, every quarter, a corporate credit union must perform net interest income (NII) modeling to project earnings in multiple interest rate environments for a period of no less than two years. Corporates are also subject to weighted average life limits for asset maturities of a maximum two years maturity. Because of the overlap of these two requirements, NCUA proposes to only require NII modeling for 1 year instead of two.

  • NCUA’s Request for Comments

NCUA is particularly interested in comments on proposed thresholds and definitions as well as specifically on the following:

  • Is the proposed definition of corporate CUSO appropriate? Does it capture the types of corporate credit union investments most likely to pose systemic risk and is 25% the proper threshold for designating a CUSO a corporate CUSO?
  • How do corporate credit unions structure their investment in CUSOs? Is it generally through stock? Contributed equity? Membership interests? Are there any types of typical ownership interests excluded from the proposed rule?
  • Can Corporates comply with annual disclosure compensation rules without receiving compensation information from the natural person CUSOs?
  • Should the rule prohibit corporate credit union investment is subordinated debt?
  • Is the definition of natural person credit union subordinated debt instrument appropriate?
  • Is the timeframe proposed for NII modeling appropriate?

NASCUS hosted two Legislative and Regulatory Committee calls, featuring attorneys from the Washington law firm Venable LLP on April 10 and April 15.  Questions from state regulators, credit unions, and state leagues related to operating during the COVID-19 crisis were answered.

 

StateFocus is a monthly NASCUS publication that highlights legislative and regulatory activities in the states. Each edition explores different states and various issues related to the state credit union system.

September 30, 2020 State Focus: What’s Happening in the States?

August 11, 2020 State Focus: What’s Happening in the States?

July 1, 2020 StateFocus: What’s Happening in the States?

May 28, 2020 StateFocus: What’s Happening in the States?

April 21, 2020 StateFocus State Wage Garnishment Guidance

April 16, 2020 StateFocus: State Paycheck Protection Program Guidance

March 31, 2020 StateFocus: State Responses to COVID-19

February 27, 2020 StateFocus: What’s Happening in the States?

January 29, 2020 StateFocus: What’s Happening in the States?

 

NCUA 2020 Regulatory Review

Prepared by NASCUS Legislative & Regulatory Affairs Department
February 2020

The NCUA’s Office of General Counsel maintains a rolling review schedule that identifies one-third of NCUA’s existing regulations for review each year and provides notice to the public of those regulations under review for public comment.

NCUA’s Regulatory Review is a not an exclusive list of NCUA rulemaking this year. The agency also engages in discretionary rulemaking as it deems necessary.

NCUA’s complete NCUA Regulatory Review (2020) is available on NCUA’s website. NCUA will be reviewing its regulations Part 711 thru Part 747. NASCUS notes that several of these provisions were recently subject to discretionary rulemaking in 2019. However, even though they were recently subject to NCA rulemaking, NASCUS will still submit its views on improvements that may be made to those rules as well.

Part 741 is among the provisions scheduled for review. NASCUS believes the inclusion of § 741 allows for comment on every FISCU rule incorporated by reference.

Comments on NCUA’s 2020 regulatory review are due to NCUA by August 3, 2020.

 In 2017, NCUA published a summary of the agency’s evaluation of the Regulatory Review process. That report is available here.[1]

Summary

  • 711 Management Official Interlocks – Applies to FISCUs by incorporation in § 741.209. The Management Interlocks rule generally prohibits an individual from serving in a senior executive position of a credit union and another depository institution (non-credit union).
  • 712 Credit Union Service Organizations (CUSOs) – Applies in part to FISCUs by incorporation in § 741.222. The CUSO rules in Part 712 that apply to FISCUs by incorporation include § 712.2(d)(2)(ii), § 712.3(d), § 712.4 and § 712.11(b) and (c). These are the provisions that require credit unions to maintain corporate separateness from their CUSOs, and to contractually obligate their CUSOs to submit annual reports to NCUA and to provide NCUA and state regulators access to the CUSOs’ books and records.
  • 713 Fidelity Bond and Insurance Coverage for Federal Insured Credit Unions – Applies to FISCUs by incorporation in § 741.201, which directs FISCUs to follow the “minimum fidelity bond coverage stated in part 713.3, 713.5, and 713.6.” NCUA published a new final Fidelity Bond rule in July 2019. The final rule further extended the application of the rule to FISCUs, mandated a board signature on bond contracts, created a sunset of NCUA approval of bond forms, and mandate bond contracts contain an extension of discovery provisions.
  • 714 Leasing – Does not apply to FISCUs.
  • 715 Supervisory Committee Audits and Verifications – Applies to FISCUs by incorporation in § 741.202. These provisions include the requirements that FISCUs obtain either annual supervisory committee audits, or independent audits, depending on their asset size. It also requires verification of accounts at least once every two years. In September 2019, NCUA finalized changes to Part 715 Supervisory Committee rules.
  • 717 Fair Credit Reporting – Does not apply to FISCUs.
  • 721 Incidental Powers – Does not apply to FISCUs.
  • 722 Appraisals – Applies to FISCUs by incorporation in § 741.203. The rule requires FISCUs to obtain written appraisals for commercial real estate transactions involving loans with $1 million+ and residential real estate transactions involving loans of $250k+. NCUA recently proposed raising the residential real estate threshold to $400k.
  • 723 Member Business Loans – Applies to FISCUs by incorporation in § 741.203, Minimum Loan Policy Requirements. In May of 2018, NCUA published a comprehensive rewrite of its MBL rule. In NCUA’s view, the new rule marked a change from a prescriptive approach to a principle-based approach.
  • 724 Trustees and Custodians of Certain Tax-Advantaged Savings Plans – Does not apply to FISCUs.
  • 725 National Credit Union Administration Central Liquidity Facility – Applies to FISCUs by incorporation in § 741.210.
  • 740 Accuracy of Advertising and Notice of Insured Status – Applies to FISCUs by incorporation in § 741.211. These provisions prescribe the official share insurance signage and accuracy in advertising.
  • 741 Requirements for Insurance – References all rules applicable to FISCUs. NASCUS encourages state system stakeholders to include comments on any NCUA FISCU rule incorporated by reference in § 741, as well as to comment on the organization of NCUA’s rules.
  • 745 Share Insurance and Appendix – Applies to FISCUs by incorporation in § 741.212. These provisions describe the amount of coverage and describes the various accounts covered by NCUA administered share insurance.
  • 746 Appeals Procedures – In October 2017, NCUA finalized a new rule, § 746, establishing a formalized appeals process for FICUs in relation to NCUA supervisory determinations. This is the first time this rule has come up for review under NCUA’s Regulatory Review process.
  • 747 Administrative Actions, Adjudicative Hearings, Rules of Practice and Procedure, and Investigations – Applies to FISCUs by incorporation in § 741.3(a) and § 741.213. NCUA’s §747 is made up of subparts A-M. Of these, subpart E applies only to FCUs. The remaining subparts, applicable to FISCUs, include the following:
    • Subpart A addresses the administrative procedure related to, and due process afforded, credit unions subject to an administrative order by NCUA. The provisions create recourse to an administrative law judge and the right of parties to have counsel and call witnesses.
    • Subparts B & C limit discovery to document production, controls the adjudication of NCUA liquidation orders, and provides that NCUA may terminate insurance for 1) Engaging or having engaged in unsafe or unsound practices, is in unsafe or unsound condition, or has violated any applicable law, regulation, or order.
    • Subpart D provides for removal of official charged in state or federal court for a crime of dishonesty.
    • Subpart G allows a prevailing party to seek attorney fees.
    • Subpart H governs investigations conducted by the NCUA Board or its designee.
    • Subpart I governs witnesses in an NCUA investigation.
    • Subpart J applies to a credit union’s notice to NCUA to add or replace an official pursuant to § 1790a and § 700.2 where the credit union either has been chartered less than 2 years; or is in “troubled condition,” as defined by §701.14.
    • Subpart K requires NCUA to adjust CMPs to the rate of inflation.
    • Subpart L establishes the rules & procedures for FICUs subject to discretionary action under PCA. Credit unions are provided the right to a hearing before the NCUA board and the right to call witnesses. Credit unions may also seek the determination of the NCUA Ombudsman. Subpart L also requires NCUA copy state regulators all related notices to a SCU under the provision.
    • Subpart M establishes the rules and procedures for NCUA’s imposition of discretionary PCA actions against a corporate credit union.

[1] NASCUS has been told NCUA will no longer publish these summaries of the previous year’s Regulatory Review process.

NCUA Proposed Rule: Subpart D to Part 708a Combination Transactions with Non-Credit Unions; Credit Union Asset Acquisitions 

Prepared by NASCUS Legislative & Regulatory Affairs Department
February 2020

NCUA is proposing to add a new Subpart D to § 708a of its Rules & Regulations to clarify the NCUA’s procedures and the requirements related to transactions where a federally insured credit union (FICU) assumes the assets and liabilities of a bank or other non-credit union entity (combination) or where the FICU merges or otherwise consolidates with a non-credit union entity. Existing § 708a applies to federally insured state credit unions (FISCUs) by reference in § 741.208.[1]

The proposed Subpart D would be comprised of the following 5 sections:

  • 708a.401 Definitions
  • 708a.402 Approval Required for Combination Transactions
  • 708a.403 Submission to the NCUA
  • 708a.404 Assumption of Deposits; Federal Share Insurance Required
  • 708a.405 Federal Credit Union Membership

NCUA proposes applying all provisions to FISCUs except proposed § 708a.405.

The proposal would also amend § 741.8 of the NCUA’s regulations to clarify other applicable regulations and apply a 6 factor test for approval for § 741.8 transactions.

The proposed rule may be read here. Comments are due to NCUA March 30, 2020.

Summary

The incidents of FICUs purchasing some, or all, of the assets and liabilities of a bank remain relatively rare with respect to the annual number of credit union mergers and the number of intra bank M&A activities.

CU Purchased All Bank Assets & Liabilities CU Purchased Some of the Bank Asset and Liabilities (for example branches)  

Bank M&A Activity in the Given Year
2020 9 pending (2/1/20) 8 pending (2/1/20) —-
2019 11 4 179
2018 7 1 249
2017 3 1 261
2016 2 4 247
2015 2 1 284
2014 1 1 303
2013 2 3 252

 

Until now, the only NCUA rule on point was § 741.8 which requires NCUA Regional Director (RD) approval before a FICU may assume an assignment of deposits, shares, or liabilities from and privately insured credit union or any bank or other non-FICU depository entity. NCUA notes that the experience it has gained in approving the 43 previous transactions informs the current proposed rulemaking.

 

NCUA is also proposing to expand § 741.8 to apply to all asset purchases, not only loan purchases and liability assumptions. NCUA notes that in reviewing credit union/bank combination transactions, its staff have occasionally identified non-loan assets that are problematic, either because they are impermissible for FICUs or because they would pose undue risk to the FICU. [emphasis added by NASCUS]

 

The Federal Credit Union Act

Section 205 of the Federal Credit Union Act (FCUA) states:

  • Except as provided in paragraph (2), no insured credit union shall, without the prior approval of the Board— (A) merge or consolidate with any noninsured credit union or institution; (B) assume liability to pay any member accounts in, or similar liabilities of, any noninsured credit union or institution; (C) transfer assets to any noninsured credit union or institution in consideration of the assumption of liabilities for any portion of the member accounts in such insured credit union; or (D) convert into a noninsured credit union or institution.
  • See 12 U.S.C 1785(b)(1)

Pursuant to the FCUA, when considering whether to approve an assumption of liabilities as described above, the NCUA Board must consider 6 factors:

  • the history, financial condition, and management policies of the credit union
  • the adequacy of the credit union’s reserves
  • the economic advisability of the transaction
  • the general character and fitness of the credit union’s management
  • the convenience and needs of the members to be served by the credit union
  • whether the credit union is a cooperative association organized for the purpose of promoting thrift among its members and creating a source of credit for provident or productive purposes.[2]

 Subpart D

Proposed Subpart D would have 5 provisions:

  • Proposed § 708a.401 Definitions

This provision defines what NCUA would consider a “combination transaction” covered by the rule, a definition for a “credit union” and “non-credit union” and a definition for “Regional director.”

A “combination transaction” would mean “any transaction in which a credit union does one or more of the following: Merges or consolidates with any non-credit union; assumes liability to pay any deposits in, or similar liabilities of, any non-credit union; or transfers assets to any noncredit union in consideration of the assumption of liabilities for any portion of the member accounts in the insured credit union.”

NCUA intends the term “combination transaction’’ to differentiate Subpart D transactions from other types of transactions such as mergers between FICUs, mergers between FICUs and privately insured credit unions (PICUs), FICU conversions to banks, and FICU purchases of loans that are not part of a merger or consolidation

A “credit union” would have the same meaning as an insured credit union § 101 of the FCUA and would be defined by referencing the FCUA rather than incorporating the definition in its entirety in the proposed rule.[3]

“Non-credit union” would be defined as any financial institution that is not a Federal credit union or a State credit union, as those terms are defined in § 101 of the FCUA.[4]

The definition of “Regional director” includes NCUA RDs and the Director of ONES.

  • Proposed § 708a.402 Approval Required for Combination Transactions

This provision would require NCUA and state regulator prior approval for a combination transaction. The proposal does not specify the order in which those approvals must be obtained nor does it provide a timeframe within which NCUA approve or deny the transaction.

The proposed rule incorporates the FCUA provision listing 6 factors the NCUA must weigh when considering a request for approval for a combination transaction. The first 4 factors are related to safety and soundness:

  • the history, financial condition, and management policies of the credit union
  • the adequacy of the credit union’s reserves
  • the economic advisability of the transaction
  • the general character and fitness of the credit union’s management

The remaining 2 factors are not safety and soundness related:

 

  • the convenience and needs of the members to be served by the credit union
  • whether the credit union is a cooperative association organized for the purpose of promoting thrift among its members and creating a source of credit for provident or productive purposes

 

NCUA explicitly notes the last 2 factors are not safety and soundness. In so noting, NCUA says it reserves the right to object to a transaction, or portions of a transaction, even absent safety and soundness concerns.

 

Paragraph (c) of the proposal would require FICUs hold a vote of their board of directors before the FICU submits its application package to NCUA and the state.

 

  • Proposed § 708a.403 Submission to the NCUA

This section addresses issues related to the FICU’s membership, permissible powers, and the duties of the FICU’s board.

 

A credit union seeking to acquire the assets and liabilities of bank or otherwise engage in a combination transaction must submit a request to its state regulator and NCUA Regional Director. The request to NCUA must:

 

  • explain the credit union’s plan for converting the bank customers to credit union members
  • include a balance sheet and income statement for each institution; a combined financial statement showing the transaction’s potential impact on the credit union’s net worth; a summary of the credit union’s due diligence process, and support for the transaction price
  • include a delinquent loan summary for any assets involved in the transaction; and an analysis of the adequacy of the credit union’s ALLL account
  • list any of the other institution’s assets that would be impermissible for the credit union to hold under the FCUA and/or state law and explain the plan to dispose of those impermissible assets in advance of the transaction
  • include a list of bank shareholders
  • include any other information the NCUA RD requests in his or her discretion

 

The credit union’s request for approval must also include a certification signed by each of the credit union’s directors that voted in favor of the combination transaction. The certification must include:

 

  • a statement that each director signing the certification supports the proposed transaction & believes it’s in the best interests of the current & potential members
  • a statement that credit union management has adequately explained the transaction’s expected effect on the credit union’s net worth and balance sheet, as well as how the purchase price was determined
  • a description of all materials submitted to NCUA with the certification
  • a statement that each director signing the certification had the opportunity to review all relevant facts about the transaction before voting on it
  • A statement that none of the director signing the certification has any financial or personal interest in the transaction

 

The proposal also suggests that additional requirements may be published in NCUA’s NSPM.

 

  • 404 Insurance of Deposits

This provision deals with share insurance of the new members’ deposits. The proposal requires the FICU to demonstrate that any customer deposits it assumes will be insured by the NCUSIF as of the transaction close. NCUA notes that generally, FICUs do not have authority to hold non-insured deposits and that the FDIC will not approve a transaction unless the bank customers’ deposits transferred to the credit union will have immediate NCUSIF coverage.

 

  • Proposed § 708a.405 Federal Credit Union Membership

This provision applies only to FCUs. Under the proposal, FCUs must first demonstrate that depositors are within the FCU’s FOM and then explain how the depositor will become a member. NCUA’s long held position has generally required that to become a member of the FCU the other entity’s customer must affirmatively act through an authoritative vote in the affirmative by a majority of the bank customers (akin to a merger vote for credit unions) or individual consent before the closing of a combination transaction.

 

Section 741.8 Purchase of Assets and Assumption of Liabilities

In addition to creating a new Subpart D for combination transactions, the proposal makes changes to existing § 741.8. The proposed changes would:

 

  • Add “purchase of assets” other than loans to the list of authorized transactions for which FICUs must receive NCUA pre-approval (the current list is comprised of purchasing loans or assuming an assignment of deposits, shares, or liabilities from non a FICU)
  • Revises existing paragraph (c) to reference the other NCUA regulations that apply to each particular type of transaction:

 

  • For a merger or consolidation with the type of institution listed in § 741.8(a)(2) credit unions must comply with § 708a Subpart D
  • For a merger or consolidation with an institution of the type listed in § 741.8(a)(1), credit unions must comply with § 708b
  • For assumptions of deposits or other liabilities, not part of a merger or consolidation, from the type of institution listed in § 741.8(a)(2), credit unions must comply with Subpart D of part 708a
  • For purchases of loans, not part of a merger or consolidation, from the type of institution listed in § 741.8(a)(1) and (a)(2), credit unions must comply with § 701.23
  • For purchase of other assets, not part of a merger or consolidation, from the type of institution listed in § 741.8(a)(1) and (a)(2), credit unions must comply with § 703 or § 721

 

  • Adds a new paragraph (d) to enumerate the statutory factors NCUA must consider when evaluating transactions (the same 6 considerations noted above for combinations). NCUA would consider the 6 factors FOR ALL §741.8 transactions

-End-

[1] Part 741.208 reads in full:

Any credit union which is insured pursuant to title II of the Act and which merges with another credit union or non-credit union institution, and any state-chartered credit union which voluntarily terminates its status as a federally insured credit union, or converts from federal insurance to other insurance from a government or private source authorized to insure member accounts, shall adhere to the applicable requirements stated in section 206 of the Act and parts 708a and 708b of this chapter concerning mergers and voluntary termination or conversion of insured status.

 

[2] 12 U.S.C. 1785(c). As discussed below in this summary, these same 6 factors will now be applied to § 741.8 transactions as well.

[3] The definition in 12 U.S.C. 1752(7) reads as follows:

“The term “insured credit union” means any credit union the member accounts of which are insured in accordance with the provisions of subchapter II of this chapter, and the term “noninsured credit union” means any credit union the member accounts of which are not so insured;”

[4] The definitions in 12 U.S.C. 1752(1) and 1752(6) respectively are as follows:

“Federal credit union” means a cooperative association organized in accordance with the provisions of this chapter for the purpose of promoting thrift among its members and creating a source of credit for provident or productive purposes; and The terms “State credit union” and “State chartered credit union” mean a credit union organized and operated according to the laws of any State, the District of Columbia, the several territories and possessions of the United States, the Panama Canal Zone, or the Commonwealth of Puerto Rico, which laws provide for the organization of credit unions similar in principle and objectives to Federal credit unions.

20-RA-01 Other Supervisory Committee Audits

January 2020

In September 2019, NCUA published a final rule making changes to the Supervisory Committee regulations in Part 715. In the final rule, NCUA is replacing the Supervisory Committee Guide with an Appendix to the rule, eliminating the “Balance Sheet Audit” and the “Report on Examination of Internal Controls Over Call Reporting”, and eliminating the 120-day deadline for third-party written audit reports to be delivered to the credit union.

The rule, which applies to FISCUs by way of reference in Part 741.202, took effect January 6, 2020.

NCUA’s Part 715 establishes share insurance audit requirements for FISCUs and general audit requirements for FCUs:

Type of charter Asset size Minimum audit required to fulfill supervisory committee audit responsibility Part 715
section
FCU $500 Million or more Financial statement audit per GAAS by independent, State-licensed person §715.5
Less than $500 Million but greater than $10 Million Either financial statement audit or other supervisory committee audit
$10 Million or less Supervisory committee audit.
FISCU $500 Million or more Financial statement audit per GAAS by independent, State licensed person §715.6
Less than $500 Million Supervisory committee audit unless audit prescribed by State law is more stringent

 

For credit unions fulfilling Part 715 obligations with a Supervisory Committee Audit, new § 715.7 requires those audits to comply with the requirements of an Appendix to Part 715. The Appendix establishes the minimum procedures which must be performed for Other Supervisory Committee Audits, including:

  • Review of Board minutes for material changes to the credit union’s activities
  • Test and confirm asset and liability accounts such as: loans, cash on deposit, investments, shares, and borrowings
  • Test material equity, income and expense accounts;
  • Test for unrecorded liabilities;
    • Review key internal controls including at a minimum: bank reconciliations procedures, cash controls, dormant account controls, wire and ACH transfer controls, loan approval and disbursement procedures, controls over accounts of employees and officials, other real estate owned, and foreclosed and repossessed assets
  • Test mathematical accuracy of the allowance for loan and lease loss account and ensure the methodology is properly applied;
  • Test loan delinquency and charge-offs.

To help credit unions comply with the Appendix requirements, NCUA has published an Other Supervisory Committee Audit Minimum Procedures Guide. The 26-page Guide expands on the Appendix to help credit unions meet audit requirements.

Summary: Proposed Rule re: Remittance Transfers Under the Electronic Fund Transfers Act (Regulation E)

12 CFR Part 1005

The Consumer Financial Protection Bureau (CFPB)

Prepared by the NASCUS Legislative & Regulatory Affairs Department

January 2020

The Consumer Financial Protection Bureau (CFPB) is proposing changes to the Remittance rule to mitigate the effects of the expiration of a statutory exception that allows insured institutions to disclose estimates instead of exact amounts to consumers.  The exception is scheduled to expire on July 21, 2020.

In addition, the Bureau is proposing to increase a safe harbor threshold in the Rule related to whether a person makes remittance transfers in the normal course of its business, which would have the effect of reducing compliance costs for entities that make a limited number of remittance transfers annually.

Comments must be received by January 21, 2020.  The proposed rule can be found here and the unofficial redline version of the proposed rule can be found here.

Summary

The Electronic Fund Transfer Act (EFTA), as amended by Dodd Frank, establishes certain protections for consumers sending international money transfers or remittance transfers.  The Bureau’s remittance rule (Regulation E) implements these protections.  The Bureau is proposing several amendments to the remittance rule.

First, the Bureau is proposing to increase a safe harbor threshold in the rule which would have the effect of reducing compliance costs for entities that make a limited number of remittance transfers annually.  Currently, the rule provides a safe harbor that exempts “persons” from the rule requirements if the person provided 100 or fewer remittance transfers in the previous calendar year and provides 100 or fewer remittance transfers in the current calendar year.  The Bureau is proposing to adjust the safe harbor threshold from 100 transfers to 500 transfers annually.

Second, the Bureau is proposing changes to the Rule to mitigate the effects of the expiration of a statutory exception that allows insured institutions to disclose estimates of the exchange rate and covered third party fees to customers instead of exact amounts.  The exception is due to expire on July 21, 2020.  The proposal would adopt a permanent exception that would permit insured institutions to estimate the exchange rate and third party fees for remittance transfers to certain countries under certain conditions.

Comments Requested

The Bureau is seeking comment on a number of items including (but not limited to):

  • Proposal to increase the normal course of business safe harbor threshold
  • Data or other evidence that would assist it in determining what number would be most appropriate for the safe harbor threshold
  • Whether its proposal to increase the safe harbor threshold would in fact help reduce burden for banks/credit unions that provide transfers only as an accommodation to their customers?
  • Whether any banks/credit unions exited the market or limited the number of remittance transfers provided as a result of compliance costs associated with the remittance rule? And, if so, whether they would reenter the market or lift the limits they placed on their remittance transfer services if the Bureau raised the safe harbor threshold as proposed?
  • Whether entities that would no longer be covered under the remittance rule would discontinue providing the disclosures, cancellation rights or error resolution protections that they are currently required to provide pursuant to the rule? If such entities would continue providing consumer protections for some or all of their remittance transfers, the Bureau seeks comment on what those protections would be.
  • Whether any additional clarification or guidance regarding the proposed revised safe harbor threshold is needed and, if so, what specifically should be addressed?
  • Whether and to what extent providers have encountered transitional issues when qualifying for the existing safe harbor after complying with the rule? Whether providers who expect to qualify for the proposed revised safe harbor anticipate any transitional issues?

 

 

 

 

 

 

 

 

 

Letters to Credit Unions 20-CU-01 NCUA Supervisory Priorities for 2020

January 2020

 NCUA has published a Letter to Credit Unions (LTCU) identifying the agency’s supervisory priorities for 2020. The LTCU also updates stakeholders on NCUA’s efforts to modernize its examination and supervision program.

NCUA identified seven supervisory priorities for 2020. Six of the priorities are carried over from the 2019. The seven 2020 supervisory priorities are:

  • BSA/AML
  • Consumer Financial Protection
  • Credit Risk
  • Current Expected Credit Losses
  • Information Systems and Cyber Security
  • Liquidity
  • The End of LIBOR (new for 2020)

NCUA will continue to operate under the extended exam cycle. For FISCUs, this means an NCUA exam cycle of 8-12 months for FISCUs with:

  • Assets greater than $1 billion;
  • Composite NCUA CAMEL code 4 or 5 with assets greater than $50 million; or
  • Composite NCUA CAMEL code 3 with assets greater than $250 million.

All other FISCUs will be on a risk-based exam cycle (and at least once every 5 years). See LTCU 16-CU-12 for more information on NCUA’s risk-based exam program. Credit unions < $50 million will continue to be examined under the Small Credit Union Exam Program procedures.

NCUA’s 2020 Supervisory Priorities

Bank Secrecy Act Compliance/Anti-Money Laundering

NCUA requires its examiners review BSA/AML on every exam. NCUA, and states, have MOUs in place with FinCEN and BSA/AML continues to be a priority for policy makers in Washington, DC. Credit unions should be aware of the following joint statements issued by federal regulators in 2018 and 2019 on BSA related issues:

Furthermore, in 2020, NCUA is emphasizing customer due diligence and beneficial ownership compliance requirements as well as the timely and accurate filing of SARs and CTRs. Additional developments for 2020:

NCUA has resources available: Bank Secrecy Act Resources. To enhance understanding of BSA/AML/OFAC examination and compliance obligations, NASCUS’ 2020 BSA Conference will be held November 9-12, 2020, in Ft. Lauderdale, Florida. NASCUS’ BSA Conference, presented jointly with CUNA, is the largest credit union specific BSA conference in the country.

Consumer Financial Protection

NCUA conducts risk-focused reviews of applicable consumer financial protection regulations during every NCUA examination. In addition, each year NCUA rotates consumer protection regulations to emphasize in examinations. In 2020, in addition to any risk-focused regulations identified for review, NCUA examiners will also focus on:

  • Electronic Fund Transfer Act (Regulation E).NCUA examiners will evaluate Electronic Fund Transfer (EFT) policies & procedures, review initial account disclosures, & review Reg. E’s error resolution procedures.
  • Fair Credit Reporting Act (FCRA).NCUA examiners will review credit reporting policies and procedures and the accuracy of reporting to credit bureaus.
  • Gramm-Leach-Bliley (GLBA).NCUA examiners will continue to assess compliance with GLBA and credit union protection of member non-public personal information.
  • Small dollar lending (including PAL Lending).NCUA examiners will test for compliance with NCUA PALs rules and interest rate cap and evaluate any non-PALs lending programs.
  • Truth in Lending Act (Regulation Z).NCUA examiners will evaluate credit union practices related to:
  • annual percentage rates and late charges and related siclosures
  • how loan payments are applied to principal
  • interest, fees and other charges, and late fees
  • whether the application is consistent with the agreement and disclosures
  • Military Lending Act (MLA) & Servicemembers Civil Relief Act (SCRA).NCUA will review credit union compliance with the MLA and SCRA.

Resources are available at NCUA’s Consumer Compliance resources webpage.

Credit Risk

In 2020, NCUA examiners will place emphasis on the review of the credit union’s loan underwriting standards and procedures. In particular, examiners will verify if credit unions properly analyzed borrowers’ ability to meet debt service requirements without undue reliance on the value of any collateral. NCUA will also be implementing enhanced examination procedures for credit unions with very high concentrations in specific loan types. For more information, see NCUA LTCU 10-CU-03, Concentration Risk.

Current Expected Credit Losses

FASB has delayed CELC until January 2023 for credit unions. However, NCUA examiners will continue to discuss CECL implementation plans with credit unions.

For more information, see the April 2019 Interagency FAQs.

 Information Systems and Assurance (Cybersecurity)

An updated version of ACET will deployed in 2020. In early 2020, Credit unions will be able to access the system thru N NCUA’s website to complete self- assessments. From 2018 to the present, NCUA has conducted cybersecurity maturity assessments for credit unions with assets of $250 million or greater. In 2020, the NCUA will continue completing these assessments for credit unions with assets over $250 million and begin completing assessments for credit unions with assets over $100 million. The initial maturity assessment cycle will be completed in 2021. Starting in 2022, the agency will refresh the maturity assessments following the same cycle. NCUA will also be piloting new procedures in 2020 to evaluate critical security controls during examinations between maturity assessments.

For more information, visit the NCUA’s Cybersecurity Resources website.

LIBOR Cessation Planning

As NASCUS has be discussing with its members, the LIBOR index is ending in 2021. This has the potential to disrupt credit union involved LIBOR -based products and contracts such as loans, investments, derivatives, deposits, and borrowings. Credit unions should be proactively transitioning away from instruments using LIBOR as a reference rate. NCUA examiners will assess credit unions’ exposure and planning related to the discontinuance of LIBOR.

Liquidity Risk

Credit unions continue to exhibit lower levels of on-balance-sheet liquidity due, in part, to strong loan growth trends and increased competition for traditional, low-cost deposits. In 2020, NCUA examiners will review liquidity management & planning by evaluating:

  • effects of changing interest rates on the market value of assets & borrowing capacity;
  • Scenario analysis for liquidity risk modeling, including possible member share migrations and scenario analysis for changes in cash flow projections
  • The appropriateness of contingency funding plans

 NCUA Exam Modernization

  •  NCUA Connect – In 2019, the NCUA began piloting a new secure user portal, NCUA Connect. In 2020 NCUA Connect will be made available to all credit unions and state regulators.
  • MERIT – The Modern Examination and Risk Identification Tool (MERIT). MERIT will be released to all examination staff in the second half of 2020. Credit unions will be able to use MERIT to send files or updates to examiners and access examination reports.

For more information, see  NCUA Connect & MERIT. In addition, NCUA has several other initiatives underway such as CUOnline (the Profile and Call Report). See  Examination Modernization Initiatives.

 Statutory and Regulatory Updates

There have been recent changes to laws and regulations applicable to credit unions.

  • Commercial Real Estate Appraisal Rule – Effective October 22, 2019, new final rule § 722 increased the appraisal threshold for commercial real estate transactions from $250,000 to $1 million. Now for commercial loans under $1 million credit unions may choose to conduct a written estimate of market value or obtain an appraisal by a state-licensed appraiser. The final rule increases the standards for thequalifications and independence of individuals conducting written estimates of market value.
  • Private Flood Insurance Rule – Under new private flood insurance rules credit unions must accept certain flood insurance policies from private providers. For other policies from private providers, credit unions have the option to accept the insurance if the policy meets certain criteria. For more information, see the NCUA Regulatory Alert, 19-RA-01, Flood Insurance Alternatives.
  • Public Unit and Nonmember Shares Rule – The NCUA approved a final rule amending Section 701.32 regarding public unit and nonmember shares. Effective January 29, 2020, federally insured credit unions generally can accept public unit and nonmember shares in an amount up to 50% of paid-in and unimpaired capital and surplus, less any public unit or nonmember shares, or $3 million, whichever is greater. If public unit and nonmember shares, combined with borrowings exceeds 70% then a written plan must be kept.
  •  Serving Hemp Businesses – Credit unions may provide the customary range of financial services for business accounts, including loans, to lawfully operating hemp-related businesses within their FOM. The NCUA encourages credit unions to thoughtfully consider whether they are able to safely and properly serve hemp-related businesses. In 2020, NCUA examiners will be collecting data through the examination process concerning the types of services credit unions are providing to hemp-related businesses. See NCUA Regulatory Alert, 19-RA-02, Serving Hemp Businesses, and the USDA’s website.
  • Supervisory Committee Audits Rule – NCUA has amended § 715 to provide additional flexibility to FICUs regarding financial statement audits. These amendments go into effect January 6, 2020.The NCUA has issued a new guide to assist supervisory committees in conducting other supervisory committee audits.

Letters to Credit Unions No.: 19-CU-01 Supervisory Priorities 2019

January 2019

NCUA has published the first Letter to Credit Unions of 2019 to provide stakeholders an overview of the agency’s supervisory priorities for the year. As discussed in more detail below, NCUA’s supervisory priorities for 2019 include:

  • BSA/AML Compliance
  • Credit Concentration
  • Consumer Compliance
  • CECL
  • Information Systems
  • Liquidity & Interest Rate Risk

NCUA also notes that the extended examination cycle introduced in 2017 will be fully implemented in 2019. (See LTCU 16-CU-12 and NASCUS summary). In addition, NCUA examiners will continue to use the small credit union exam program procedures for most credit unions with assets under $50 million and a risk focused examination for all others. NCUA examiners will have increased flexibility to conduct suitable examination work offsite. (see NCUA’s Flexible Examination Program (FLEX) pilot).

NASCUS notes that most FISCU examinations will continue to be conducted primarily by state examiners.

Bank Secrecy Act Compliance

NCUA will enhance its scrutiny of BSA/AML compliance, especially the beneficial owner compliance. (see LTCU 18-CU-02). NCUA also has information on its Bank Secrecy Act website.

Concentrations of Credit

NCUA will focus on large concentrations of loan products and concentrations of specific risk characteristics. If excessive levels of credit concentration risk are identified, examiners will work with credit union management to identify strategies to mitigate the risk. (See LTCU 10-CU-03 Concentration Risk).

Consumer Compliance

NCUA examiners will continue to perform limited reviews of HMDA quarterly Loan/Application Registers, or full-year Loan/Application Registers, taking into account the partial exemptions that took effect on May 24, 2018. (See Consumer Financial Protection Update 18-01). NCUA will also continue to focus on Military Lending Act compliance. (See NCUA Regulatory Alerts 16-RA-04, Guidance on Regulatory Changes Affecting Military Lenders and 16-RA-06, Department of Defense’s Interpretive Guidance on Military Lending Act Limitations on Terms of Consumer Credit Extended to Service Members and Dependents)

NCUA examiners will review credit unions’ compliance with Regulation B’s notification requirements following adverse action taken on consumer credit applications and overdraft policies and procedures for compliance with Regulation E. (See NCUA’s Consumer Compliance Regulatory Resources website).

 Current Expected Credit Losses (CECL)

NCUA examiners will inquire about credit union efforts to prepare for FASB’s January 1, 2022 effective date for CECL and how the changes alter ALLL funding needs. (See LTCU 17-CU-05, and LTCU 16-CU-13 on CECL).

Information Systems and Assurance

NCUA will continue to assess credit union cybersecurity maturity using the Automated Cybersecurity Examination Toolbox (ACET) for credit union with over $250 million in assets that have not previously received an assessment. NCUA will also be focusing on

credit union IT risk management and credit union oversight of third-party service provider arrangements. (See NCUA’s Cybersecurity Resources website).

 

Liquidity and Interest Rate Risks

In assessing credit union liquidity and interest rate risk management, NCUA will consider:

 

  • The potential effects of rising interest rates on the market value of assets that affect changes to net worth and borrowing capacity
  • Member preference shifts to shares with more market sensitivity
  • Management’s ability to meet liquidity needs given the increased competitive pressures that affect share balances

 

​-End-

 

Letters to Credit Unions 19-CU-04 Use of Alternative Data in Credit Underwriting

December 2019

NCUA, FRB, CFPB, FDIC, and the OCC have issued a joint statement on the use of alternative data by financial institutions in determining a borrowers’ creditworthiness. The joint statement focuses on the benefits and risks to financial institutions of using such data and the expectation that financial institutions develop a compliance program for managing the risks of alternative data.

Alternative data “means information not typically found in the consumer’s credit files of the nationwide consumer reporting agencies or customarily provided by consumers as part of applications for credit.”

The joint statement states that alternative data is being used (or considered) for credit underwriting, as well as in fraud detection, marketing, pricing, servicing, and account management. The use of alternative data:

  • may improve the speed, cost and accuracy of credit decisions
  • may help evaluating potential borrowers who may not obtain credit in the mainstream credit system
  • may enable consumers to obtain additional products or more favorable pricing/terms based on enhanced assessments of repayment capacity

Banks and credit unions using alternative data must ensure that usage is consistent with safe and sound operations. Appropriate controls should include a rigorous assessment of the quality and suitability of the data. The appropriateness of the data models should also be evaluated. The federal agencies acknowledge that in some cases the use of alternative data may present no greater risk than the use of traditional data. For example, automating the use of cash flow data to better evaluate borrowers’ ability to repay loans is at it’s a core a longstanding underwriting principle.

The guidance provides several additional resources for managing risks associated with models, including those that may leverage alternative data:

Use of such data may implicate several consumer protection statues and regulations including fair lending laws, prohibitions against unfair, deceptive, or abusive acts or practices, and the Fair Credit Reporting Act. A well-designed compliance management program can help provide the financial institution a thorough analysis of relevant consumer protection laws and regulations to ensure firms understand the opportunities, risks and compliance requirements before using alternative data.

Some alternative data, such as cash flow data, may present lower risks than other data. However, some alternative data may warrant more robust compliance management including appropriate testing, monitoring and controls.

-End-